Pimcore version 12.3.3 contains an authenticated Cross-site Scripting (XSS) vulnerability. An attacker with permission to edit document content can inject crafted HTML or JavaScript into a Document embed editable, leading to script execution when the published page is viewed. The vulnerability has a CVSS 4.8 (medium) score and requires user interaction and low privileges.